Detection rules › Kusto
Mimecast Targeted Threat Protection - Impersonation Protect
This is a third-party alert feed, not a detection over modeled telemetry. The vendor product raised the finding; this rule forwards it into the SIEM. It is searchable for reference but is excluded from the detection-rule browse and the ATT&CK coverage matrix.
Detects a maliciously tagged impersonation
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Collection | T1114 Email Collection |
Rule body kusto
id: d8e7eca6-4b59-4069-a31e-a022b2a12ea4
name: Mimecast Targeted Threat Protection - Impersonation Protect
description: Detects a maliciously tagged impersonation
severity: High
requiredDataConnectors:
- connectorId: MimecastTTPAPI
dataTypes:
- MimecastTTPImpersonation_CL
enabled: true
query: MimecastTTPImpersonation_CL| where taggedMalicious_b == true;
queryFrequency: 5m
queryPeriod: 15m
triggerOperator: gt
triggerThreshold: 0
suppressionDuration: 5h
suppressionEnabled: false
tactics:
- Exfiltration
- Collection
- Discovery
relevantTechniques:
- T1114
alertRuleTemplateName:
incidentConfiguration:
createIncident: true
groupingConfiguration:
enabled: true
reopenClosedIncident: false
lookbackDuration: 1d
matchingMethod: AllEntities
eventGroupingSettings:
aggregationKind: AlertPerResult
entityMappings:
- entityType: MailMessage
fieldMappings:
- identifier: Sender
columnName: senderAddress_s
- identifier: SenderIP
columnName: senderIpAddress_s
- identifier: Recipient
columnName: recipientAddress_s
version: 1.0.0
kind: Scheduled
Stages and Predicates
Stage 1: source
MimecastTTPImpersonation_CL
Stage 2: where
| where taggedMalicious_b == true;
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
taggedMalicious_b | eq |
|